EHS Risk Assessment: A Complete Guide to Managing Workplace Risk In 2026

An environment, health and safety (EHS) risk assessment is a structured process used to identify environmental, health and safety hazards, evaluate the risks they create and determine the control measures required to protect people, operations and the environment.

Effective EHS risk assessment goes beyond simply listing workplace hazards. It provides organisations with a repeatable approach to hazard identification, risk evaluation, risk control and continuous improvement. This helps businesses understand their most significant safety risks, prioritise action and demonstrate that identified risks are being actively managed.

For organisations dealing with multiple sites, assessments or compliance responsibilities, EHS software can provide a central system for managing inspections, risk assessments, incident reporting and other EHS records.

A thorough EHS risk assessment should also be treated as a living document. New equipment, processes, substances, employees and working practices can introduce potential hazards, while existing control measures may become less effective over time.

This guide explains the EHS risk assessment process, including how to identify hazards, calculate risk ratings, use a risk matrix, implement controls and establish a more proactive approach to EHS risk management.

What is an EHS risk assessment?

An EHS risk assessment examines the environmental, health and safety risks associated with a workplace, activity, process, asset or site.

The purpose is to identify potential hazards before they result in harm, understand their potential consequences and establish effective control measures to eliminate or minimise risks.

In practical terms, an EHS risk assessment asks several fundamental questions:

• What could cause harm?
• Who or what could be affected?
• How likely is the event to happen?
• How severe could the consequences be?
• What existing control measures are already in place?
• Are those controls sufficient?
• What additional controls are required?
• Who is responsible for implementing them?
• When should the risk be reviewed?

This makes risk assessments a fundamental part of wider risk management processes.

In the UK, employers have legal responsibilities to protect employees and others from harm. The Health and Safety Executive (HSE) explains that employers must identify hazards, determine how likely and how serious the resulting harm could be and take action to eliminate or control risks.

EHS broadens the focus beyond occupational safety alone. Depending on the organisation, assessments may consider safety risks, occupational health, hazardous substances, environmental hazards, emissions, waste, equipment, fire, processes and other areas capable of causing harm or creating regulatory compliance issues.

Why is EHS risk assessment important?

EHS risk assessment is important because organisations cannot effectively control risks they have not identified or understood.

Without a consistent risk assessment process, safety concerns can remain unnoticed until an accident, environmental incident or compliance problem occurs. Proactive risk management attempts to identify these issues earlier.

A robust EHS risk assessment can help an organisation:

• Prevent workplace injuries and ill health
• Identify environmental risks
• Improve regulatory compliance
• Prioritise risks according to their severity
• Determine appropriate control measures
• Improve consistency between sites and teams
• Document decisions and responsibilities
• Reduce the likelihood of costly incidents
• Support a stronger safety culture
• Improve operational efficiency
• Demonstrate a structured approach to risk management

Risk management also has wider business implications. Serious incidents can result in downtime, investigations, damaged equipment, lost productivity and legal or regulatory consequences. Compliance risk may include potential fines, legal penalties and reputational damage.

Environmental risk can similarly create significant consequences. Waste, emissions, spills or poor handling of hazardous materials can affect the surrounding environment while creating additional operational and compliance issues.

Identifying these potential risks before they develop into larger problems allows organisations to allocate resources more effectively.

Consistent EHS risk management can also support stakeholder and shareholder confidence by demonstrating that significant operational, environmental and safety risks are being systematically identified and managed.

What are the 5 Steps of an EHS risk assessment?

There are five fundamental stages involved in carrying out an effective EHS risk assessment:

1. Identify the hazards
2. Identify who or what could be harmed
3. Evaluate and prioritise the risks
4. Determine and implement control measures
5. Record, monitor and review the assessment

These stages turn hazard identification into an ongoing risk management process rather than a one-off paperwork exercise.

Step 1: Identify the hazards

Hazard identification is the first risk assessment stage.

A hazard is something with the potential to cause harm. This may be immediately obvious, such as dangerous machinery, or less visible, such as prolonged exposure to a hazardous substance.

Organisations should consider the full range of activities taking place within the workplace when trying to identify potential hazards.

These could include:

• Machinery and moving equipment
• Vehicles
• Electrical equipment
• Working at height
• Slips and trips
• Manual handling
• Hazardous substances
• Noise or vibration
• Fire hazards
• Poor ergonomics
• Waste
• Emissions
• Biological hazards
• Workplace processes
• Maintenance activities
• Occupational health hazards

Hazards should not be identified purely by walking around a workplace once.

Previous incidents, near misses, inspection findings, employee concerns and safety data sheets can provide valuable information. Reporting hazards should therefore form part of the wider safety culture.

Non-routine activities are important too. Maintenance, shutdowns, cleaning, equipment changes and unusual operating conditions can introduce risks that are not present during normal operations.

Environmental hazards require similar consideration. An organisation might identify potential environmental impact from waste disposal, chemical spills, excessive emissions, contaminated water or inefficient use of resources.

Climate risk may also be relevant where climate-related events or longer-term trends could affect employees, sites, equipment or business operations.

The objective at this stage is to establish a sufficiently complete picture of the hazards identified across the activity being assessed.

Step 2: Identify who or what could be harmed

Once hazards have been identified, the next step is to establish who or what could be affected and how.

Employees are an obvious consideration, but a thorough risk assessment should consider all relevant groups.

These could include:

• Employees
• Contractors
• Temporary workers
• Visitors
• Customers
• Members of the public
• Maintenance teams
• Cleaners
• Delivery drivers
• People with additional vulnerabilities

Different groups may experience the same hazard differently.

For example, an experienced machine operator may understand the risks associated with particular equipment, while a new employee or contractor may be unfamiliar with the same safety risks.

Environmental risk assessments may also need to consider impacts beyond people. Potential consequences could affect land, air, water, wildlife, neighbouring properties or the wider environment.

Identifying affected groups and environments makes it easier to understand the real risk impact rather than considering a hazard in isolation.

Step 3: Evaluate and prioritise the risks

After hazard identification, the organisation needs to evaluate the risk associated with each hazard.

Risk evaluation typically considers two main factors:

Likelihood: How probable is it that the event will happen?

Severity: How serious would the potential consequences be if it did happen?

A hazard that is unlikely to occur but could have severe consequences may still require urgent attention. Equally, an event with relatively moderate consequences may require significant controls if it happens frequently.

This is where structured risk scoring becomes valuable.

Risk scoring assigns numerical values to factors such as risk probability and risk severity, helping organisations evaluate risks using a consistent framework.

For example, an organisation might assign likelihood and severity scores between one and five. Multiplying the two numerical values produces an overall risk score:

Likelihood × Severity = Risk Score
An event with a likelihood score of 4 and severity score of 5 would therefore produce a risk score of 20.

The resulting risk rating can be used to determine the overall risk level and prioritise risks requiring further action.

However, numerical values should support professional judgement rather than replace it. A simple calculation cannot capture every factor affecting an EHS risk.

Organisations should consider the specific context, people exposed, existing controls, duration of exposure and potential consequences when evaluating risks.

Step 4: Determine and implement control measures

Once the organisation understands the risk level, the next stage is to determine control measures.

Control measures are the practical actions used to eliminate hazards or reduce the likelihood or severity of harm.

The first question should be whether the hazard can be removed completely.

Where elimination is not reasonably practicable, organisations should consider other forms of risk control.

A commonly used hierarchy moves through:

1. Elimination
2. Substitution
3. Engineering controls
4. Administrative controls
5. Personal protective equipment

Elimination removes the hazard completely.

Substitution replaces a hazardous substance, process or activity with a less hazardous alternative.

Engineering controls physically separate people from hazards or modify equipment and environments to reduce exposure. Machine guards, extraction systems and physical barriers are examples.

Administrative controls change how work is performed. These can include policies, procedures, training, supervision, scheduling and safe systems of work.

Personal protective equipment (PPE) provides individual protection where risks remain. Depending on the activity, this could include gloves, safety footwear, respiratory protection, hearing protection or eye protection.

PPE should not automatically be the first response to every hazard. HSE guidance places personal protective equipment at the bottom of the hierarchy of controls and states that it should be considered after more effective measures such as elimination, substitution and engineering controls.

The objective when organisations implement control measures is to reduce the remaining risk as far as reasonably practicable.

Step 5: Record, monitor and review the assessment

The risk assessment process does not finish when controls have been selected.

Organisations need to record their significant findings and ensure the agreed actions are actually implemented.

A useful record should make it clear:

• What hazards were identified
• Who or what could be harmed
• Existing control measures
• Initial risk rating
• Additional controls required
• Who is responsible for each action
• Target completion dates
• Residual risk after controls
• Review dates

Documentation of control measures is critical for accountability. Vague instructions such as “take care” or “work safely” do not provide the same clarity as specific actions, responsibilities and deadlines.

The assessment should subsequently be reviewed to determine whether the controls remain effective.

This is why EHS risk assessments should be treated as living documents rather than completed forms that are filed away and forgotten.

What types of risk should an EHS assessment cover?

The exact scope of an EHS risk assessment depends on the organisation, workplace and activities involved.

However, several broad categories frequently need consideration.

Health and safety risks

Safety risk includes events that could result in injury, death or other harm.

Examples include falls, machinery incidents, electrical hazards, workplace transport, fire, manual handling and unsafe working practices.

Occupational health risks may develop over a longer period. Examples include excessive noise exposure, hazardous substances, repetitive movements, vibration and other workplace conditions that can affect health.

Environmental risks

Environmental hazards are activities or conditions capable of causing negative environmental impact.

These might involve:

• Chemical releases
• Air pollution
• Waste
• Water contamination
• Hazardous materials
• Resource consumption
• Emissions

Effective EHS risk management should identify where operations could affect the environment and determine control measures to prevent or minimise environmental impact.

Compliance risk

Compliance risk relates to the consequences of failing to meet applicable legislation, regulations, standards or other requirements.

Potential consequences can include regulatory action, fines, legal penalties, disruption and reputational damage.

Risk assessments help organisations document how relevant risks have been identified and what measures are being taken to manage them.

Management of change risk

Changes to equipment, processes, substances, employees, suppliers or working practices can introduce new hazards.

Management of change risk arises when these changes are poorly assessed or implemented without considering their EHS implications.

Risk assessments should therefore be reviewed before or following significant operational changes.

How does a 5×5 risk matrix work?

A risk matrix provides a structured method of comparing risk probability with risk severity.

A 5×5 risk matrix uses five rating levels for likelihood and five for severity, creating 25 possible combinations.

For example, likelihood could be rated from:

1. Rare
2. Unlikely
3. Possible
4. Likely
5. Almost certain

Severity could similarly range from:

1. Insignificant
2. Minor
3. Moderate
4. Major
5. Severe

Each likelihood score is combined with a severity score to produce an overall risk score.

For example:

Unlikely probability (2) × Major consequence (4) = Risk score 8
Almost certain (5) × Severe consequence (5) = Risk score 25
This risk scoring matrix allows organisations to categorise and prioritise risks.

Lower scores may represent a low risk, while increasing scores indicate risks requiring greater attention. Organisations should establish their own clearly defined thresholds and actions rather than assuming that one scoring scale is appropriate for every workplace or industry.

The main advantage of a 5×5 risk matrix is consistency. Teams can apply the same framework when evaluating risks across different activities, sites and departments.

It also makes prioritisation easier. When resources are limited, higher risk ratings can help organisations identify which hazards require the most immediate attention.

For a more detailed explanation of scoring, likelihood, severity and different matrix sizes, see our complete risk assessment matrix guide.

What makes a control measure effective?

Effective control measures should address the actual source or nature of the risk.

A control should not simply exist on paper. It needs to work in practice.

When determining whether existing control measures are sufficient, consider:

• Whether the hazard can be eliminated
• Whether a safer alternative is available
• Whether people can be physically separated from the hazard
• Whether engineering controls can reduce exposure
• Whether procedures or training need to change
• Whether PPE is necessary for remaining risks
• Who is responsible for the control
• Whether the control is being followed
• Whether it needs inspection or maintenance
• Whether it has actually reduced the risk

Control measures should also be specific.

“Employees should be careful around machinery” is vague.

“Install a fixed machine guard and inspect it before each shift” defines a specific action.

Similarly, “provide training” is less useful than identifying what training is required, who needs it and when it must be completed.

After organisations implement controls, the risk should be evaluated again. This determines the residual risk and whether additional risk reduction is required.

For hazards requiring a more specialised assessment, organisations may need dedicated processes. Fire hazards, for example, require consideration of fire-specific risks, people at risk and precautions. Teams managing these assessments across sites can use fire risk assessment software to digitise assessment activity, capture findings and maintain associated records.

What is an EHS risk register?

A risk register is a central record of identified risks and the information needed to manage them.

Rather than allowing individual risk assessments to exist in isolation, the risk register provides an overview of the organisation’s risk landscape.

Depending on the organisation, a risk register might record:

• The identified hazard
• Risk description
• Affected people or areas
• Potential consequences
• Risk probability
• Risk severity
• Overall risk score
• Existing control measures
• Additional actions
• Action owner
• Target dates
• Current status
• Residual risk
• Review date

Risk registers centralise identified risks in one document or system, helping organisations see where the most significant exposures exist.

They can also improve accountability.

If a risk management plan identifies that a new engineering control must be implemented, the risk register can record the action, responsible person and target date.

This helps turn risk analysis into practical action.

For larger organisations, maintaining this information manually can become increasingly difficult. Risk assessment software provides a digital approach to recording hazards, carrying out assessments, applying risk scoring and maintaining risk information across multiple sites and operations.

How often should EHS risk assessments be reviewed?

There is no value in performing risk assessments and then assuming that the identified risks will remain unchanged indefinitely.

Workplaces evolve.

New equipment arrives. Employees change. Processes are redesigned. Different substances are introduced. Regulations change. Existing controls deteriorate or prove less effective than expected.

Regular reviews are therefore essential to effective EHS risk assessment.

A review may be required when:

• There has been an accident or near miss
• Employees report new safety concerns
• New equipment is introduced
• Working practices change
• New hazardous substances are used
• Existing controls are no longer effective
• The workplace layout changes
• New information about a hazard becomes available
• Environmental conditions change
• Legislation or compliance requirements change

Organisations may also establish scheduled reviews as part of their wider risk management plan.

The important point is that the review should determine whether the assessment still accurately represents the current working environment.

HSE describes health and safety management as an ongoing process rather than a one-off task. Reviewing controls and learning from incidents, near misses and workplace changes contributes to continuous improvement.

How does risk management software support EHS risk assessments?

As organisations grow, managing risks through separate documents and spreadsheets can become increasingly cumbersome.

Risk management software can improve the efficiency of data collection, risk analysis, documentation and reporting by bringing information into a more structured system.

For EHS teams, this can make it easier to establish consistent risk management processes across multiple sites and activities.

Instead of individual teams developing entirely separate approaches, digital risk assessment tools can provide a standard framework for recording identified hazards, assessing risk levels and documenting controls.

Velappity’s EHS risk assessment software enables organisations to complete digital risk assessments, manage EHS activities and support compliance management from a central platform.

Digital EHS risk management can be particularly useful where teams need to perform risk assessments across different locations.

A structured system can support:

• Consistent risk assessment processes
• Centralised EHS information
• Hazard records
• Risk scoring
• Inspection records
• Documented control measures
• Reporting
• Audit trails
• Recurring inspections
• Mobile assessments
• Compliance records

Risk management software does not remove the need for competent judgement. Technology supports the process, while the quality of the assessment still depends on correctly identifying hazards, evaluating risks and selecting suitable controls.

Moving from reactive to proactive risk management

The most effective EHS risk management processes do more than respond to incidents.

Proactive risk management focuses on identifying weaknesses and potential risks before serious consequences occur.

This requires organisations to use information from multiple sources.

Risk assessments provide one source, but inspection findings, reported hazards, near misses, incidents, employee feedback and previous corrective actions can all contribute to a better understanding of risk.

For example, repeated reports of the same safety concern may indicate that existing control measures are ineffective. A pattern of minor incidents may reveal a more significant underlying hazard. Changes in operations management may introduce risks that were not considered in the original assessment.

Proactive risk mitigation uses this information to intervene earlier.

This approach can help organisations:

• Identify emerging safety risks
• Prioritise risks before incidents occur
• Improve existing controls
• Reduce repeated problems
• Make better-informed decisions
• Strengthen regulatory compliance
• Minimise environmental impact
• Improve workplace safety

Regular EHS assessments can also contribute to a proactive safety culture.

Employees who are encouraged to participate in hazard identification and reporting hazards are more likely to understand the risks associated with their work. Management can then demonstrate that reported concerns result in appropriate action.

Over time, this creates a stronger safety culture where risk management becomes part of normal operations rather than something performed purely for compliance.

Creating a safer workplace through continuous improvement

An effective EHS risk assessment should produce action.

The objective is not to achieve the largest possible collection of risk assessment documents. It is to understand risk and make better decisions about how people, the environment and business operations are protected.

Continuous improvement means learning from each stage of the process.

If an incident occurs, organisations should consider whether the relevant hazards were identified.

If they were identified, were the risks evaluated correctly?

Were effective control measures selected?

Were those controls implemented?

Were they maintained?

Did employees understand them?

Could a more effective risk control have been used?

The answers should feed back into future assessments and wider risk management processes.

Organisations can also use health and safety management software to bring inspections, risk assessments, incident information and other health and safety activities into a more structured digital workflow.

The result should be an ongoing cycle of identifying hazards, evaluating risks, implementing controls and reviewing performance.

That is what turns individual risk assessments into effective EHS risk management.

EHS risk assessment FAQs

What is an EHS risk assessment?

An EHS risk assessment is a structured process for identifying environmental, health and safety hazards, evaluating the risks they create and determining appropriate control measures. It helps organisations understand potential harm and decide what action is needed to eliminate or reduce risk.

What are the five steps of an EHS risk assessment?

The five key steps are identifying hazards, determining who or what could be harmed, evaluating and prioritising risks, implementing control measures, and recording and reviewing the assessment. The process should be repeated as risks, operations and workplace conditions change.

What is the difference between a hazard and a risk?

A hazard is something with the potential to cause harm. Risk considers the likelihood of that harm occurring and how serious the potential consequences could be. Hazard identification therefore comes before evaluating the associated risk.

What is a 5×5 risk assessment matrix?

A 5×5 risk assessment matrix uses five levels of likelihood and five levels of severity to evaluate risks. Numerical values are assigned to each level and multiplied to produce a risk score. The resulting rating helps organisations compare and prioritise risks.

How is an EHS risk score calculated?

A common approach multiplies a numerical likelihood rating by a severity rating. For example, likelihood 3 multiplied by severity 4 produces a risk score of 12. Organisations should define what different scores mean within their own risk management framework.

What should an EHS risk register contain?

A risk register typically contains identified risks, potential consequences, likelihood and severity ratings, risk scores, existing control measures, additional actions, responsible people, target dates and review information. It provides a central view of risks across an organisation.

What are examples of EHS control measures?

Control measures can include eliminating a hazard, substituting it for a safer alternative, introducing engineering controls, changing procedures, providing training and using personal protective equipment. Controls should be selected according to the nature and severity of the risk.

Why should risk assessments be reviewed?

Risks change as workplaces, people, equipment and processes change. Regular reviews help organisations confirm that existing controls remain effective and identify new hazards or additional controls that may be required.

Can EHS software replace a risk assessor?

EHS and risk management software can improve how risk information is captured, organised and reported, but it does not replace competent professional judgement. Effective risk assessment still depends on correctly identifying hazards, evaluating risks and selecting appropriate controls.

How can organisations improve EHS risk management?

Organisations can improve EHS risk management by standardising assessments, encouraging employees to report hazards, reviewing incidents and near misses, documenting controls, monitoring identified risks and regularly reviewing whether control measures remain effective. This supports proactive risk management and continuous improvement rather than waiting for an incident before taking action.